DFIRHub

SugarSync

Appsv1

Author: Andrew Rathbun

SugarSync

Paths

3 paths
Paths use Windows environment variable syntax

Notes

SugarSync is an online storage service similar to Google Drive, OneDrive, etc. I had never heard of it, but it's one of 4 online storage services listed as an option on Ninite as of October 2020.

The sc1.log file appears to be the only thing relevant for this application.

Please note, this is not like OneDrive, Google Drive, etc where there's a dedicated folder where what is stored in SugarSync resides locally on the system. The user can choose folders all around their system to sync to SugarSync as changes are made on their system.

Collection commands

# PowerShell Artifact Collection Script
# Target: SugarSync
# Run as Administrator

#Requires -RunAsAdministrator

$ErrorActionPreference = "Continue"
$SourceRoot = "C:"
$DestBase   = "D:\Evidence"
$Summary = @{ Copied = 0; Missed = 0; Errors = 0 }

function Collect-Artifact {
    param(
        [Parameter(Mandatory)][string]$SourceDir,
        [Parameter(Mandatory)][string]$FolderName,
        [string]$FileMask = "*"
    )
    # Expand wildcards in any path segment (e.g. 'Program Files*',
    # 'ScreenConnect Client*'). robocopy itself does not glob the source.
    $sources = @(Get-Item -Path $SourceDir -ErrorAction SilentlyContinue |
        Where-Object { $_.PSIsContainer })
    if ($sources.Count -eq 0) {
        $Summary.Missed++
        return
    }
    $FullDest = Join-Path -Path $DestBase -ChildPath $FolderName
    $null = New-Item -ItemType Directory -Force -Path $FullDest -ErrorAction SilentlyContinue
    foreach ($src in $sources) {
        robocopy $src.FullName "$FullDest" "$FileMask" /E /COPY:DAT /R:0 /W:0 /NP /NFL /NDL /NJH /NJS 2>$null | Out-Null
        if ($LASTEXITCODE -le 7) { $Summary.Copied++ } else { $Summary.Errors++ }
    }
}

# Iterate every user profile under the source drive
Get-ChildItem "$SourceRoot\Users" -Directory -ErrorAction SilentlyContinue |
    Where-Object { $_.Name -notin @('All Users', 'Default', 'Default User', 'Public') } |
    ForEach-Object {
        $UserName = $_.Name
        # SugarSync Log File
        $UserPath = "$($_.FullName)\AppData\Local\SugarSync"
        Collect-Artifact -SourceDir $UserPath -FileMask "sc1.log" -FolderName "SugarSync_Log_File_$UserName"
        # SugarSync - Shared Folders (Default Location)
        $UserPath = "$($_.FullName)\Documents\SugarSync Shared Folders"
        Collect-Artifact -SourceDir $UserPath -FolderName "SugarSync_Shared_Folders_Default_Location_$UserName"
        # SugarSync - My SugarSync (Default Location)
        $UserPath = "$($_.FullName)\Documents\My SugarSync"
        Collect-Artifact -SourceDir $UserPath -FolderName "SugarSync_My_SugarSync_Default_Location_$UserName"
    }

Write-Host ("Collection complete. Copied: {0}  Missed: {1}  Errors: {2}" -f $Summary.Copied, $Summary.Missed, $Summary.Errors) -ForegroundColor Green

Save as .ps1 and run as Administrator. Use: powershell -ExecutionPolicy Bypass -File script.ps1

Included in collections: CloudStorage_All